[leftmargin=1.0em]
White noise perturbations are constructed as \(\tilde{x} = x + \Delta x\) , where the additive noise is sampled from a Gaussian distribution \(\Delta x \sim \mathcal {N}(0,\sigma )\) . This perturbation strategy emulates measurement errors that can result from data acquisition with poor sensors (where \(\sigma \)  corresponds to the severity of these errors).

Salt and pepper perturbations emulate defective pixels that result from converting analog signals to digital signals. The noise model takes the form
\(\mathbb {P}(\tilde{X}=X)=1 - \gamma \) , and \(\mathbb {P}(\tilde{X}=\max ) = \mathbb {P}(\tilde{X}=\min )=\gamma / 2,\) 
where \(\tilde{X}(i,j)\)  denotes the corrupted image and \(\min \) , \(\max \)  denote the minimum and maximum pixel values, respectively. \(\gamma \)  parameterizes the proportion of defective pixels.

Adversarial perturbations are “worst-case” non-random perturbations that maximize the loss \(\ell (g^\delta (X+\Delta X),y)\)  subject to the constraint \(\Vert \Delta X\Vert  \le r\)  on the norm of the perturbation. We consider the projected gradient decent for constructing these perturbations [1]}.

